Interactive Proofs Lecture 18 AM 1 Interactive Proofs 2 Interactive Proofs IP[k] 2 Interactive Proofs IP[k] IP[poly] = PSPACE 2 Interactive Proofs IP[k] IP[poly] = PSPACE IP protocol for TQBF using arithmetization 2 Interactive Proofs IP[k] IP[poly] = PSPACE IP protocol for TQBF using arithmetization We saw IP protocol for sum-check 2 Interactive Proofs IP[k] IP[poly] = PSPACE IP protocol for TQBF using arithmetization We saw IP protocol for sum-check IP[const] = AM[const] 2 Interactive Proofs IP[k] IP[poly] = PSPACE IP protocol for TQBF using arithmetization We saw IP protocol for sum-check IP[const] = AM[const] We saw public coin protocol for Graph Non-Isomorphism 2 Interactive Proofs IP[k] IP[poly] = PSPACE IP protocol for TQBF using arithmetization We saw IP protocol for sum-check IP[const] = AM[const] We saw public coin protocol for Graph Non-Isomorphism Using 2-universal hash functions 2 Interactive Proofs IP[k] IP[poly] = PSPACE IP protocol for TQBF using arithmetization We saw IP protocol for sum-check IP[const] = AM[const] We saw public coin protocol for Graph Non-Isomorphism Using 2-universal hash functions Today: Collapse of the AM hierarchy 2 Interactive Proofs IP[k] IP[poly] = PSPACE IP protocol for TQBF using arithmetization We saw IP protocol for sum-check IP[const] = AM[const] We saw public coin protocol for Graph Non-Isomorphism Using 2-universal hash functions Today: Collapse of the AM hierarchy AM[const] = AM[2] 2 Recall AM 3 Recall AM 3 Recall AM AM[2] (or simply AM) 3 Recall AM AM[2] (or simply AM) Input x 3 Recall AM AM[2] (or simply AM) Input x Random coins r come from a beacon 3 Recall AM AM[2] (or simply AM) Input x Random coins r come from a beacon 3 Recall AM AM[2] (or simply AM) Input x Random coins r come from a beacon Unbounded prover Merlin sends a “proof” message a 3 Recall AM AM[2] (or simply AM) Input x Random coins r come from a beacon Unbounded prover Merlin sends a “proof” message a Polynomial time verifier Arthur runs a deterministic verification procedure R(x;r,a), and outputs Yes or No 3 Recall AM AM[2] (or simply AM) Input x Random coins r come from a beacon Unbounded prover Merlin sends a “proof” message a Polynomial time verifier Arthur runs a deterministic verification procedure R(x;r,a), and outputs Yes or No L is said to have an AM protocol if 3 Recall AM AM[2] (or simply AM) Input x Random coins r come from a beacon Unbounded prover Merlin sends a “proof” message a Polynomial time verifier Arthur runs a deterministic verification procedure R(x;r,a), and outputs Yes or No L is said to have an AM protocol if x∈L ⇔ max Pr[Yes] > 2/3 3 Recall AM AM[2] (or simply AM) Input x Random coins r come from a beacon Unbounded prover Merlin sends a “proof” message a Polynomial time verifier Arthur runs a deterministic verification procedure R(x;r,a), and outputs Yes or No L is said to have an AM protocol if x∈L ⇔ max Pr[Yes] > 2/3 x∉L ⇔ max Pr[Yes] < 1/3 3 max Pr[Yes] 4 max Pr[Yes] Quantity of interest 4 max Pr[Yes] Quantity of interest Maximum (over prover strategies) probability (over coins from the beacon) of Arthur saying yes 4 max Pr[Yes] Quantity of interest Maximum (over prover strategies) probability (over coins from the beacon) of Arthur saying yes Evaluate the “Avg-Max tree” 4 max Pr[Yes] Quantity of interest Avg Maximum (over prover strategies) probability (over coins from the beacon) of Arthur saying yes Max ... Max ... Max Evaluate the “Avg-Max tree” R ... R ... R 4 max Pr[Yes] Quantity of interest Avg Maximum (over prover strategies) probability (over coins from the beacon) of Arthur saying yes Max ... Max ... Max Evaluate the “Avg-Max tree” Leaves: Pr[yes] = 0 or 1, as determined R ... R ... R by Arthur’s program 4 max Pr[Yes] Quantity of interest Avg Maximum (over prover strategies) probability (over coins from the beacon) of Arthur saying yes Max ... Max ... Max Evaluate the “Avg-Max tree” Leaves: Pr[yes] = 0 or 1, as determined R ... R ... R by Arthur’s program Max nodes: maximum of children 4 max Pr[Yes] Quantity of interest Avg Maximum (over prover strategies) probability (over coins from the beacon) of Arthur saying yes Max ... Max ... Max Evaluate the “Avg-Max tree” Leaves: Pr[yes] = 0 or 1, as determined R ... R ... R by Arthur’s program Max nodes: maximum of children Avg node: average of children 4 max Pr[Yes] Quantity of interest Avg Maximum (over prover strategies) probability (over coins from the beacon) of Arthur saying yes Max ... Max ... Max Evaluate the “Avg-Max tree” Leaves: Pr[yes] = 0 or 1, as determined R ... R ... R by Arthur’s program Max nodes: maximum of children Avg node: average of children Extends to AM[k], with k alternating levels 4 Soundness Amplification 5 Soundness Amplification Recall error reduction in BPP algorithms 5 Soundness Amplification Recall error reduction in BPP algorithms By repeating and taking majority 5 Soundness Amplification Recall error reduction in BPP algorithms By repeating and taking majority Exponential error reduction (by Chernoff bound) 5 Soundness Amplification Recall error reduction in BPP algorithms By repeating and taking majority Exponential error reduction (by Chernoff bound) Extends to MA 5 Soundness Amplification Recall error reduction in BPP algorithms By repeating and taking majority Exponential error reduction (by Chernoff bound) Extends to MA Given input and any answer from Merlin, to determine Pr[Yes] 5 Soundness Amplification Recall error reduction in BPP algorithms By repeating and taking majority Exponential error reduction (by Chernoff bound) Extends to MA Given input and any answer from Merlin, to determine Pr[Yes] Run many independent verifications (using independent random strings from the beacon). Chernoff bound holds. 5 Soundness Amplification Recall error reduction in BPP algorithms By repeating and taking majority Exponential error reduction (by Chernoff bound) Extends to MA Given input and any answer from Merlin, to determine Pr[Yes] Run many independent verifications (using independent random strings from the beacon). Chernoff bound holds. Increased the length of the second message 5 Parallel Repetition for AM[k] 6 Parallel Repetition for AM[k] Soundness amplification by sequential repetition/majority 6 Parallel Repetition for AM[k] Soundness amplification by sequential repetition/majority Exponential amplification, just like in MA. But be careful! Not independent executions (Merlin can adapt strategy over the repetitions.) But not a problem! 6 Parallel Repetition for AM[k] Soundness amplification by sequential repetition/majority Exponential amplification, just like in MA. But be careful! Not independent executions (Merlin can adapt strategy over the repetitions.) But not a problem! But increases rounds 6 Parallel Repetition for AM[k] Soundness amplification by sequential repetition/majority Exponential amplification, just like in MA. But be careful! Not independent executions (Merlin can adapt strategy over the repetitions.) But not a problem! But increases rounds Soundness amplification without increasing rounds 6 Parallel Repetition for AM[k] Soundness amplification by sequential repetition/majority Exponential amplification, just like in MA. But be careful! Not independent executions (Merlin can adapt strategy over the repetitions.) But not a problem! But increases rounds Soundness amplification without increasing rounds Parallel repetition 6 Parallel Repetition for AM[k] Soundness amplification by sequential repetition/majority Exponential amplification, just like in MA. But be careful! Not independent executions (Merlin can adapt strategy over the repetitions.) But not a problem! But increases rounds Soundness amplification without increasing rounds Parallel repetition More careful! Merlin’s answers (and probability of proof being rejected) in the parallel sessions could be correlated 6 Parallel Repetition for AM[k] Soundness amplification by sequential repetition/majority Exponential amplification, just like in MA. But be careful! Not independent executions (Merlin can adapt strategy over the repetitions.) But not a problem! But increases rounds Soundness amplification without increasing rounds Parallel repetition More careful! Merlin’s answers (and probability of proof being rejected) in the parallel sessions could be correlated Still turns out to give exponential amplification 6 MA ⊆ AM 7 MA ⊆ AM Publishing random test before receiving proof 7 MA ⊆ AM Publishing random test before receiving proof Completeness is no worse 7 MA ⊆ AM Publishing random test before receiving proof Completeness is no worse If MA soundness error was sufficiently small, can use union bound over all Merlin messages to get that the AM soundness error is still small 7 MA ⊆ AM Publishing random test before receiving proof Completeness is no worse If MA soundness error was sufficiently small, can use union bound over all Merlin messages to get that the AM soundness error is still small If MA soundness error < 1/2m+2, where m is the length of Merlin’s message, AM soundness error < 1/4 7 MA ⊆ AM Publishing random test before receiving proof Completeness is no worse If MA soundness error was sufficiently small, can use union bound over all Merlin messages to get that the AM soundness error is still small If MA soundness error < 1/2m+2, where m is the length of Merlin’s message, AM soundness error < 1/4 Note: Argument similar to why BPP ⊆ P/poly 7 MA ⊆ AM Publishing random test before receiving proof Completeness is no worse If MA soundness error was sufficiently small, can use union bound over all Merlin messages to get that the AM soundness error is